Google Chrome vulnerabilities

A use after free vulnerability in Video in Google Chrome on Windows prior to version 149.0.7827.115 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

An out-of-bounds read vulnerability in the Video component of Google Chrome on ChromeOS prior to version 149.0.7827.115 allows a remote attacker who has compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.

Insufficient validation of untrusted input in Network in Google Chrome prior to version 149.0.7827.115 allowed a remote attacker who compromised the renderer process to leak cross-origin data via a crafted HTML page.

A race condition in Safe Browsing in Google Chrome on Mac prior to version 149.0.7827.115 allowed a remote attacker who compromised the renderer process to potentially perform a sandbox escape via a malicious file.

Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Inappropriate implementation in Mojo in Google Chrome on Windows prior to version 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via a malicious file.

A use after free vulnerability in the Network component of Google Chrome prior to version 149.0.7827.115 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic.

A use after free vulnerability in WebMIDI in Google Chrome on Windows prior to version 149.0.7827.115 allowed a remote attacker who compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Use after free in DigitalCredentials in Google Chrome prior to version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Race condition vulnerability in V8 in Google Chrome prior to version 144.0.7559.99 allows a remote attacker to exploit type confusion via a crafted HTML page.

Google Chrome prior to version 149.0.7827.103 has an inappropriate implementation in Guest View, allowing a remote attacker to perform UI spoofing via a crafted HTML page. (Severity: Medium)

Use-after-free vulnerability in the Tracing component of Google Chrome prior to 149.0.7827.103. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.

Use-after-free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use-after-free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Google Chrome on Windows prior to version 149.0.7827.103 has an Uninitialized Use vulnerability in the Video component. A remote attacker who compromised the renderer process can obtain potentially sensitive information from process memory via a crafted HTML page.

Google Chrome prior to version 149.0.7827.103 has an inappropriate implementation in Passwords, allowing a remote attacker to leak cross-origin data via a crafted HTML page. (Severity: High)

In Google Chrome prior to 149.0.7827.103, a use-after-free vulnerability in ServiceWorker allows a remote attacker who compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.

Inappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103. A remote attacker who compromised the renderer process could bypass site isolation via a crafted HTML page.

Use-after-free vulnerability in the Read Anything component of Google Chrome prior to 149.0.7827.103. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.

Insufficient validation of untrusted input in the New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

In Google Chrome on Mac prior to 149.0.7827.103, an out-of-bounds read and write vulnerability in Media allows a remote attacker who compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.

Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Insufficient validation of untrusted input in the Dawn component in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

Google Chrome on Mac prior to version 149.0.7827.103 has an inappropriate implementation in MediaCapture, allowing a remote attacker to leak cross-origin data via a crafted HTML page. (Severity: High)

Insufficient policy enforcement in the Network component in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability in WebCodecs in Google Chrome prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Use-after-free in Ozone in Google Chrome on Linux prior to 149.0.7827.103 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in Media in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free vulnerability in the Codecs component of Google Chrome on Windows prior to 149.0.7827.103. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.

Google Chrome prior to version 149.0.7827.103 has an integer overflow in libyuv, allowing a remote attacker who compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Severity: High)

Google Chrome on Mac prior to 149.0.7827.103 has a race condition in the network component that could allow a remote attacker to escape the sandbox after compromising the network process.

Insufficient validation of untrusted input in Dawn in Google Chrome on Linux and ChromeOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Google Chrome prior to version 149.0.7827.103 has an out-of-bounds read vulnerability in Skia, allowing a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. Severity: High.

Use after free in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free vulnerability in InterestGroups component of Google Chrome prior to 149.0.7827.103. A remote attacker can execute arbitrary code inside a sandbox via a crafted HTML page.

Heap buffer overflow in GPU component of Google Chrome on Android prior to 149.0.7827.103. A remote attacker who compromised the renderer process can escape the sandbox via a crafted HTML page.

Use after free in PDF in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

Out-of-bounds read in Media in Google Chrome on ChromeOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High).

Google Chrome on Linux and ChromeOS prior to version 149.0.7827.103 has an Uninitialized Use vulnerability in the Codecs component. A remote attacker can leak cross-origin data via a crafted video file.

Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the GPU process to potentially exploit heap corruption via a crafted HTML page.

Insufficient validation of untrusted input in the Input component of Google Chrome prior to 149.0.7827.103 allows a remote attacker to perform UI spoofing via a crafted HTML page.

Google Chrome on Windows prior to version 149.0.7827.103 has an out-of-bounds read vulnerability in the Dawn component. A remote attacker can leak cross-origin data via a crafted HTML page.

Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Type Confusion vulnerability in Bindings in Google Chrome prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free vulnerability in Views component of Google Chrome on Windows prior to 149.0.7827.103. A remote attacker who compromised the renderer process can escape the sandbox via a crafted HTML page.